Axis Insurance Company v. Barracuda Networks, Inc.

CourtCourt of Appeals for the First Circuit
DecidedNovember 20, 2025
Docket24-1920
StatusPublished

This text of Axis Insurance Company v. Barracuda Networks, Inc. (Axis Insurance Company v. Barracuda Networks, Inc.) is published on Counsel Stack Legal Research, covering Court of Appeals for the First Circuit primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Axis Insurance Company v. Barracuda Networks, Inc., (1st Cir. 2025).

Opinion

United States Court of Appeals For the First Circuit

No. 24-1920

AXIS INSURANCE COMPANY, a/a/o Zoll Medical Corporation and Zoll Services LLC, a/s/o Fusion LLC,

Plaintiff, Appellant,

v.

BARRACUDA NETWORKS, INC.; SONIAN INC.,

Defendants, Appellees.

APPEAL FROM THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MASSACHUSETTS

[Hon. Nathaniel M. Gorton, U.S. District Judge]

Before

Gelpí, Thompson, and Montecalvo, Circuit Judges.

Stephen D. Rosenberg, with whom Wagner Law Group was on brief, for appellant.

Christopher P. Silva, with whom Joseph L. Demeo, Michael R. Stanley, Samuel B. Goodwin, and DEMEO LLP were on brief, for appellees.

November 20, 2025 GELPÍ, Circuit Judge. This case stems from a 2018 data

breach at Barracuda Networks, Inc., ("Barracuda") that exposed the

protected health information ("PHI") of patients of Zoll Services

LLC, a subsidiary of Zoll Medical Corporation (collectively,

"Zoll"). Zoll had obtained its data-security services from Fusion,

LLC ("Fusion"), which in turn relied on Barracuda's technology to

fulfill its contract with Zoll. Axis Insurance Company ("Axis"),

in its derivative capacity as Zoll's assignee and Fusion's

subrogee, now brings tort and contract claims against Barracuda.

The district court granted Barracuda's motion for summary judgment

on all claims. For the reasons stated below, we affirm.

I. BACKGROUND

In reviewing the district court's decision granting

summary judgment to Barracuda, we recite the facts in the record

in the light most favorable to Axis and draw all reasonable

inferences from those facts in its favor. See Sutherland v.

Peterson's Oil Serv., Inc., 126 F.4th 728, 734 (1st Cir. 2025).

A. Factual Background

Fusion and Barracuda's corporate predecessors1 entered

into an Original Equipment Manufacturer agreement ("OEM") through

Fusion is the successor-in-interest to Apptix, Inc., having 1

acquired Apptix in 2016 and merged it into Fusion in 2018. Similarly, Barracuda is the successor-in-interest to Sonian, Inc., following a 2017 acquisition. As a result, Zoll became a Fusion customer, and Fusion became a Barracuda customer. For ease of reference, Apptix will be referred to as "Fusion" and Sonian will - 2 - which Fusion was allowed to resell Barracuda's email archiving

services to its customers. The OEM was conditioned on Fusion's

inclusion of appropriate limitation of liability and

indemnification language in its customer contracts. The OEM

included a provision reserving Barracuda's right to

"audit . . . all applicable books and records relating to the

[services provided by Barracuda]" and a clause stating that "[n]o

failure or delay of [Barracuda] in exercising any right or remedy

under [the OEM] shall operate as a waiver of such right"

("anti-waiver provision").

Shortly after the OEM, Zoll -- a company that sells

medical devices and receives and stores customer PHI -- became a

Fusion customer, acquiring services for electronic messaging and

email communications. The contract between Fusion and Zoll

("Hosting Agreement") did not include appropriate limitation of

liability or indemnification provisions, as required by the OEM.

Zoll separately entered into a Health Insurance Portability and

Accountability Act ("HIPAA") Business Associate Agreement ("BAA")

with Fusion in which Fusion agreed to, among other things, use

appropriate safeguards to prevent unauthorized use or disclosure

of PHI and ensure that any subcontractor or vendor to whom it

provides PHI agreed to the same restrictions and conditions

be referred to as "Barracuda" unless further precision is otherwise required. - 3 - regarding the protection of PHI. There is no evidence that Fusion

ever ensured Barracuda's compliance with the BAA.

In 2018, a data breach at Barracuda exposed Zoll's

HIPAA-protected customer information to an unauthorized third

party. Following the breach, Zoll's affected customers brought a

class action lawsuit against Zoll. Zoll settled with its customers

and was responsible for the payment of damages to the class

members.

B. Procedural Background

In 2020, Zoll commenced arbitration proceedings against

Fusion and the instant litigation against Barracuda. Fusion

successfully moved to intervene in the litigation as a Rule 20

Party and asserted claims against Barracuda. In a previous order,

the district court dismissed most of their claims, but retained

Zoll's claim of equitable indemnification and Fusion's claims of

breach of contract and breach of the covenant of good faith.

Pursuant to the parties' arbitration and settlements,

Zoll and Fusion's claims against Barracuda were assigned to

Axis -- Fusion's insurer. Axis was thus substituted as plaintiff

in 2022.

After discovery, Barracuda moved for summary judgment

against Axis on the surviving claims. The district court granted

Barracuda's motion. First, the district court held that Zoll and

Barracuda's relationship "c[ould] best be described as one of an

- 4 - independent contractor," and that this status, without more, did

not create the derivative or vicarious relationship required for

equitable indemnification under Massachusetts law. Second, the

court held that the breach of contract claim could not proceed

because Fusion failed to fulfill a condition precedent in the OEM

when it failed to include the appropriate limitation of liability

or indemnification language in its customer contracts, and

Barracuda had not waived that condition. Finally, the court held

that Axis could not prove its claim of breach of the covenant of

good faith and fair dealing because it failed to demonstrate a

contractual right to which Fusion was entitled in the event of a

data breach. Thus, the covenant could not be used to create rights

that did not exist in the contractual relationship.

Axis timely appealed.

II. DISCUSSION

A. Standard of review

We review the district court's summary judgment rulings

de novo. Cruz-Cedeño v. Vega-Moral, 150 F.4th 1, 5 (1st Cir.

2025). Summary judgment is appropriate if, based on the record,

there remains no dispute of material fact -- that is, if "there is

no factual determination which a 'rational factfinder' could make

as to the 'existence or nonexistence' of a fact that 'has the

potential to change the outcome of the suit' -- such that 'the

moving party is entitled to judgment as a matter of law.'" Ithier

- 5 - v. Aponte-Cruz, 105 F.4th 1, 6 (1st Cir. 2024) (quoting Borges ex

rel. S.M.B.W. v. Serrano-Isern, 605 F.3d 1, 4-5 (1st Cir. 2010));

see Fed. R. Civ. P. 56(a). Summary judgment is also appropriate

if the nonmoving party "fails to make a showing sufficient to

establish the existence of an element essential to [their] case"

with respect to which they "bear the burden of proof." Celotex

Corp. v.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Borges Ex Rel. SMBW v. Serrano-Isern
605 F.3d 1 (First Circuit, 2010)
American Title Insurance v. East West Financial
16 F.3d 449 (First Circuit, 1994)
Corrada Betances v. Sea-Land Service, Inc.
248 F.3d 40 (First Circuit, 2001)
Lohnes v. Level 3 Communications, Inc.
272 F.3d 49 (First Circuit, 2001)
Robert C. Hahn v. Francis W. Sargent
523 F.2d 461 (First Circuit, 1975)
Milissa Garside v. Osco Drug, Inc.
895 F.2d 46 (First Circuit, 1990)
Bachorz v. Miller-Forslund
703 F.3d 27 (First Circuit, 2012)
D. Federico Co., Inc. v. Commonwealth
415 N.E.2d 855 (Massachusetts Appeals Court, 1981)
Fireside Motors, Inc. v. Nissan Motor Corp. in U.S.A.
479 N.E.2d 1386 (Massachusetts Supreme Judicial Court, 1985)
Elias v. Unisys Corp.
573 N.E.2d 946 (Massachusetts Supreme Judicial Court, 1991)
M.J.G. Properties, Inc. v. Hurley
537 N.E.2d 165 (Massachusetts Appeals Court, 1989)
Anthony's Pier Four, Inc. v. HBC ASSOCIATES
583 N.E.2d 806 (Massachusetts Supreme Judicial Court, 1991)
Dunkin' Donuts Inc. v. Panagakos
5 F. Supp. 2d 57 (D. Massachusetts, 1998)
Dickow v. United States
740 F. Supp. 2d 231 (D. Massachusetts, 2010)
Rodriguez-Cardi v. MMM Holdings, Inc.
936 F.3d 40 (First Circuit, 2019)
Leonard v. Lumbermens Mutual Casualty Co.
10 N.E.2d 469 (Massachusetts Supreme Judicial Court, 1937)
Hollywood Barbecue Co. v. Morse
50 N.E.2d 55 (Massachusetts Supreme Judicial Court, 1943)
Metropolitan Transit Authority v. Railway Express Agency, Inc.
84 N.E.2d 26 (Massachusetts Supreme Judicial Court, 1949)

Cite This Page — Counsel Stack

Bluebook (online)
Axis Insurance Company v. Barracuda Networks, Inc., Counsel Stack Legal Research, https://law.counselstack.com/opinion/axis-insurance-company-v-barracuda-networks-inc-ca1-2025.